CVE-2023-4863: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

High severity · published Sep 12, 2023

CVE-2023-4863

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

In wildKEV

8.8

CVSS

100%

EPSS

Yes

On KEV

Description

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)100.0% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Sep 13, 2023

Federal remediation dueOct 4, 2023

Ransomware campaign useNot known

Affected products

Which versions

Chrome · Google

116.0.5845.187 before 116.0.5845.187 · source: vendor, NVD

Firefox · Mozilla

before 102.15.1; before 117.0.1; 115.1.0 before 115.2.1 · source: NVD

libwebp · Google

1.3.2 before 1.3.2 · source: vendor, NVD

Active IQ Unified Manager · Netapp

All versions, or not specified · source: NVD

Debian Linux · Debian

10.0; 11.0; 12.0 · source: NVD

Edge Chromium · Microsoft

before 116.0.1938.81 · source: NVD

Fedora · Fedoraproject

37; 38; 39 · source: NVD

Honeyview · Bandisoft

before 5.51 · source: NVD

Seequent Leapfrog · Bentley

before 2023.2 · source: NVD

Teams · Microsoft

before 1.6.00.26463; before 1.6.00.26474 · source: NVD

Thunderbird · Mozilla

before 102.15.1; 115.0 before 115.2.2 · source: NVD

Webp Image Extension · Microsoft

before 1.0.62681.0 · source: NVD

In the news

VulnerabilityHigh

Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system. The following versions of Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz are affected: Mitsubishi Electric GENESIS64 >=10.97|<=10.97.2 (CVE-2023-4863) Mitsubishi Electric ICONICS Suite >=10.97|<=10.97.2 (CVE-2023-4863) Mitsubishi Electric GENESIS <=11.03 (CVE-2026-16436, CVE-2026-16437) Mitsubishi Electric GENESIS64 <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438) Mitsubishi Electric ICONICS Suite <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438) Mitsubishi Electric Hyper Historian <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438) Mitsubishi Electric AnalytiX <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438) Mitsubishi Electric MobileHMI <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438) Mitsubishi Electric IoTWorX <=10.97.3 (CVE-2026-16436, CVE-2026-16437) Mitsubishi Electric MC Works64 vers:all/* (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438) Mitsubishi Electric GENESIS32 vers:all/* (CVE-202...

CVE-2023-4863 CVE-2026-16436 CVE-2026-16437

Oct 27, 2026·CISA Advisories

Affected product

Chrome

Google

All Chrome CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-4863

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-4863

CISA KEV catalogue